CVEs published April 15, 2019
22 CVEs were published on April 15, 2019: 2 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 22
- Critical
- 2
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- VMware ESXi · VMware Workstation +1
- 3
- IBM API Connect
- 2
- Shimo VPN
- 2
- Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- 1
- F5 BIG-IP APM
- 1
- IBM BigFix WebUI Profile Management · IBM BigFix WebUI Soft…
- 1
- IBM Cognos Analytics
- 1
- IBM MQ
- 1
- urllib3
- 1
Critical 2
High 2
- CVE-2018-4009An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing.Shimo VPN
- CVE-2019-4203IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from the host OS and…IBM API Connect
Medium, low and unrated 18
- CVE-2018-16967There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path…
- CVE-2018-16966There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path…
- CVE-2018-18019XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save…
- CVE-2018-18018SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the…
- CVE-2018-18017XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save…
- CVE-2018-17586The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action.
- CVE-2018-17585The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or…
- CVE-2018-17584The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page.
- CVE-2018-17583The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action.
- CVE-2019-5517VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6)…VMware ESXi · VMware Workstation +1
- CVE-2019-5520VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6)…VMware ESXi · VMware Workstation +1
- CVE-2019-5516VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6)…VMware ESXi · VMware Workstation +1
- CVE-2019-4178IBM Cognos Analytics 11 could allow a remote attacker to traverse directories on the system.IBM Cognos Analytics
- CVE-2019-4012IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection.IBM BigFix WebUI Profile Management · IBM BigFix WebUI Soft…
- CVE-2018-1925IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly…IBM MQ
- CVE-2019-6609Platform dependent weakness.F5 BIG-IP APM
- CVE-2019-0232When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and…Apache Tomcat · org.apache.tomcat.embed:tomcat-embed-core
- CVE-2019-11236In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.urllib3